CVE-2023-22809

CVE-2023-22809 Analysis & Exploit Información básica ID de vulnerabilidad: CVE-2023-22809 Nivel de vulnerabilidad: Alto Puntuación de vulnerabilidad: 7.8 puntos Versiones afectadas: sudo 1.8.0-sudo 1.9.12p1sudo=1.8.0 or sudo =1.9.12p1 Efecto del ataque: Escalada de privilegios local Método de...

CVE-2018-15473

CVE-2018-15473 Causa El servidor OpenSSH no retrasa el procesamiento de un usuario inválido antes de analizar completamente un paquete que contiene una solicitud. Esta vulnerabilidad está relacionada con auth2-gss.c, auth2-hostbased.c y auth2-pubkey.c. Explotación Aunque esta vulnerabilidad no...

CVE-2024-25411

CVE-2024-25411 Una vulnerabilidad de cross-site scripting XSS en Flatpress v1.3 permite a los atacantes ejecutar scripts web arbitrarios o HTML mediante un payload manipulado inyectado en el parámetro username en setup.php Tipo de vulnerabilidad: Cross Site Scripting XSS Proveedor del producto:...

cve-2018-15473

CVE-2018-15473: Enumeración de Usuarios de OpenSSH OpenSSH hasta 7.7 permite a atacantes remotos enumerar nombres de usuario válidos enviando solicitudes de autenticación malformadas y observando respuestas diferenciales del servidor. Detalles Campo| Valor ---|--- Software afectado| OpenSSH 2.3...

PoC-CVE-2024-44349

PoC-CVE-2024-44349 Vulnerability found and tested in Anteeo WMS - v4.7.31 The vulnerability allows threat actors to craft an SQL command inside the username parameter and disclose data in the underlying database. The impacted versions of ANTEEO B2B WMS are from v.4.7.x to v.4.7.34 excluded. Usage...

EUVD-2026-83650

A security flaw has been discovered in Dromara UJCMS up to 12.3.1. The affected element is the function usernameExist of the file ujcms-cms/src/main/java/com/ujcms/cms/core/web/api/UserController.java of the component UserController. Performing a manipulation of the argument Username results in...

CVE-2026-93961 Dromara UJCMS UserController UserController.java usernameExist improper authorization

A security flaw has been discovered in Dromara UJCMS up to 12.3.1. The affected element is the function usernameExist of the file ujcms-cms/src/main/java/com/ujcms/cms/core/web/api/UserController.java of the component UserController. Performing a manipulation of the argument Username results in...

CVE-2026-93961

An improper authorization flaw exists in the usernameExist function of UserController.java in Dromara UJCMS up to version 12.3.1 . By manipulating the Username argument, a remote, unauthenticated attacker can obtain partial access to user information (CVSS 3.1 score: 5.3 MEDIUM , low confidential...

cve-2007-2447

CVE-2007-2447 Requisitos pysmb Información La vulnerabilidad CVE-2007-2447 afecta a Samba desde la versión 3.0.0 hasta la 3.0.25rc3. Permite a los atacantes ejecutar comandos de shell en el parámetro de nombre de usuario. Uso Abra un puerto de escucha de su elección, configure las variables en el...

PoC-CVE-2018-15473

PoC-CVE-2018-15473 OpenSSH hasta 7.7 es propenso a una vulnerabilidad de enumeración de usuarios debido a que no retrasa la salida para un usuario de autenticación no válido hasta que el paquete que contiene la solicitud se haya analizado por completo, relacionado con auth2-gss.c, auth2-hostbased...

Zoho ManageEngine ADSelfService Plus 6121 - Username Enumeration

Zoho ManageEngine ADSelfService Plus 6121 is vulnerable to username enumeration CVE-2022-28987. The Forgot Password functionality responds differently for existing and non-existing users, allowing attackers to enumerate valid usernames. id: CVE-2022-28987 info: name: Zoho ManageEngine ADSelfServi...

WAVLINK WN533A8 - Improper Access Control

WAVLINK WN533A8 M33A8.V5030.190716 is susceptible to improper access control. An attacker can obtain usernames and passwords via view-source:http://IPADDRESS/sysinit.shtml?r=52300 and searching for logincheckuser; and thereby possibly obtain sensitive information, modify data, and/or execute...

Zoo Management System 1.0 - SQL Injection

Zoo Management System 1.0 contains a SQL injection vulnerability via the username parameter on the login page. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id:...

modoboa 2.0.4 - Admin TakeOver

Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4. id: CVE-2023-0777 info: name: modoboa 2.0.4 - Admin TakeOver author: r3Y3r53 severity: critical description: | Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to...

Webmin < 1.920 - Authenticated Remote Code Execution

rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialisevariable makes an eval call. NOTE: the WebminServersIndex documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must...

Purchase Order Management v1.0 - Cross Site Scripting (Reflected)

Purchase Order Management v1.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the password parameter at /purchaseorder/classes/login.php. id: CVE-2023-29623 info: name: Purchase Order Management v1.0 - Cross Site Scripting Reflected author: theamanrawat severity:...

DomainMOD 4.13.0 - Cross-Site Scripting

DomainMOD 4.13.0 is vulnerable to cross-site scripting via reporting/domains/cost-by-owner.php in the "or Expiring Between" parameter. id: CVE-2020-20988 info: name: DomainMOD 4.13.0 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.13.0 is vulnerable to...

Loan Management System 1.0 - SQL Injection

Loan Management System 1.0 contains a SQL injection vulnerability via the username parameter. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id: CVE-2025-9744 info: name:...

Pritunl VPN Server 1.29.2145.25 - Username Enumeration

Pritunl 1.29.2145.25 contains a username enumeration issue caused by different error responses in /auth/session login attempts, letting attackers verify valid usernames, exploit requires network access to the login endpoint. id: CVE-2020-25200 info: name: Pritunl VPN Server 1.29.2145.25 - Usernam...

AnythingLLM - Username Enumeration via Password Recovery

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to commit e287fab56089cf8fcea9ba579a3ecdeca0daa313, the password recovery endpoint returns different error messages depending on whether a username exists, so enabling...